1. Field
The present invention relates generally to computer security and, more specifically, to establishing a shared encryption key between system components.
2. Description
A computer system, such as a personal computer (PC), workstation, server, mainframe computer and so on, may comprise a number of different components. Some of the system components may be peripherals used by the system to communicate with a user or another system. For example, keyboards and mice are commonly used by the user to input data into the system. A display may be used to display information to the user. A network interface device may be used to connect the computer system to other computer systems or devices over a network.
Some system components may be coupled to other components using protocols known as “plug and play” protocols. For example, by using a Universal Serial Bus (USB), a system may allow multiple peripheral devices to be connected to the system. When a new peripheral is connected to the system, the system detects and identifies the newly added system component. Such a scheme typically relies on at least one host controller device (known as a USB host controller for systems using the USB) to control and monitor access to the system by the connected peripherals.
In some cases, it may be desired for various system components to securely communicate with each other. This may be accomplished in some systems by using well-known cryptographic methods. However, difficulties may arise when exchanging cryptographic keys between system components prior to engaging in secure communications. Generally, the actions of exchanging keys may be susceptible to a “man in the middle” attack. That is, an attacker may interpose an unauthorized component or program in between two communicating components to intercept one or more of the exchanged keys. The attacker may also possibly substitute other information in the communication stream between the components.
In systems using a USB host controller, an attacker could gain control of the USB host controller during a “man in the middle” attack and defeat secure communications between a peripheral and a processor in the system.
In a certificate-based key exchange protocol, each party receives a certificate of the public key of the other party. Each party then verifies the certificate of the other party. Using this protocol in the present situation for system components would require that each peripheral (or other system component) have a unique public/private key pair stored thereon. This would increase manufacturing costs of the peripheral. In addition, to ensure that the certificate has not been revoked, the computer system would need to be “on-line” and communicatively coupled to another networked computer storing the certificate revocation information at the time of the protocol use. This may present usability problems.
In a thumbprint-based key exchange protocol, each party generates a public/private key pair and exchanges a hash of the public keys over a secured channel (e.g., an “out of band” channel). In the present situation, there is no mechanism when using this protocol for the peripheral to send the hash of its public key to the processor. If the processor were to cause the display of the complete hash of its public key, the user could enter it using the peripheral (such as a keyboard), but this would take at least 27 random keystrokes (when using the well-known hash algorithm known as Secure Hash Algorithm (SHA-1)). In addition, there would be no means for the processor to know that the peripheral had received the correct public key (and not an illegitimate public key inserted by the “man in the middle” attacker). Thus, if there were such an attack, the peripheral would know that the hash entered by the user did not match the hash of the public key received by the peripheral from the processor, but the processor would not know this. The traditional way to solve this problem is for the second party (the peripheral) to generate a public key, send it to the first party (the processor), and then have the two parties compare their hashes. This doesn't work in this case since the peripheral does not have a way to display the peripheral's hash.
Accordingly, a better method of exchanging keys between system components is needed.